Character.AI fined EUR 158,000 for notice shortcomings and late DPIA and EU representative, with a 120-day reporting duty
Subject: Character Technologies Inc. (US operator of Character.AI)
What happened
Character.AI is a generative AI service that lets users, including minors, create and chat with virtual characters. The Italian Garante opened an own-initiative investigation.
How it was handled
The investigation identified several infringements: shortcomings in the privacy notice; failure to complete the data protection impact assessment and the appointment of the EU representative within the required period; and problems with safeguards for minors and age-verification procedures. The authority acknowledged the measures introduced during the investigation but, given the risks of generative AI in an entertainment service accessible to minors, ordered further action.
Outcome
The decision was adopted on 3 July 2026 and announced on 9 July 2026: a EUR 158,000 fine plus orders to ensure age-verification systems function correctly, to make the cooling-off mechanism preventing frozen minor accounts from re-registering effective, to set minors’ profiles to private by default, and to report the measures taken to the authority within 120 days of receiving the decision.
What it means for Chinese exporters
- · The Art. 27 EU representative and the DPIA must exist at the right moment, not merely exist. Part of the infringement here was that both were done, but late — put them in the EU launch schedule ahead of the first EU user registration, and keep the mandate letter and the assessment sign-off dates.
- · A small fine does not mean a small cost: the real burden is producing verifiable remediation evidence within 120 days and implementing product-level mandates such as private-by-default profiles and an effective cooling-off period. Budget EU compliance around the remediation engineering, not the fine.
- · Minor-safe defaults are becoming a hard expectation in the EU. Consumer social and conversational products should minimise default visibility, default notifications and default data collection for minor accounts at design time, and keep the product decision record for those defaults.
- · Regulators will test whether a rejected minor can simply re-register with another email. Anti-circumvention mechanisms need test cases and recorded results, or they will be treated as compliance on paper.
Related regulations
Sources (1)
- Italian Garante fines Character Technologies Inc. EUR 158,000Italian Data Protection Authority (Garante per la protezione dei dati personali) · published 2026-07-09 · retrieved 2026-09-12
Content as of 2026-09-12 · corpus 2026.09|Compiled from public official sources with links and review dates for compliance decision support. Rules change; have licensed professionals review before external disclosure, regulatory filing or contractual commitments.